Abstract:
Canonical is advancing a major security infrastructure upgrade for the Ubuntu operating system. With the official launch of Ubuntu 26.10 released in October this year, a new feature that has received less attention before has begun to be deployed, that is, certificate revocation verification support based on the upki project. This technology aims to provide the entire Linux system with certificate verification and security protection capabilities close to the level of modern browsers.
Canonical is pushing to extend the high-standard certificate verification mechanisms long used by browsers to the entire operating system stack. To achieve this goal, the company chose the upki project from the Rustls ecosystem. The project is developed using the Rust language and is based on the certificate security technology accumulated by Mozilla over the years. It can check whether digital certificates issued by publicly trusted certificate authority have been revoked.
Currently, upki has been able to integrate with mainstream security components such as OpenSSL and Rustls, and also provides C language compatible interfaces to facilitate access to various software and development environments. This means that in the future, not only browsers, but also system command tools, package managers, and other network applications can share unified certificate revocation verification capabilities.
Canonical originally planned to enable upki support by default in Ubuntu 26.10, but since the project was not finally stabilized until September this year, it was only applied to the curl package in this release. In other words, the curl tool in Ubuntu 26.10 has begun to utilize upki for additional certificate revocation checking, rather than relying solely on the traditional certificate chain verification mechanism.
According to the development roadmap disclosed by Canonical, the development team plans to further expand the deployment scope in Ubuntu 27.04 and integrate upki into the OpenSSL software package. By then, more software that relies on OpenSSL for secure communication will automatically gain certificate revocation verification capabilities, benefiting the entire system.
The advancement of this work is closely related to a recent certificate security incident. In October this year, researchers discovered that there were serious security issues in the private keys of some intermediate certificate authorities of eMudhra, a digital certificate service provider. One of the private keys was even so weak that it was only the number "4". Theoretically, an attacker could exploit such a vulnerability to forge a website certificate to conduct a man-in-the-middle attack or identity impersonation.
After the incident, browsers such as Firefox and Chrome quickly blocked the relevant certificates, but many common applications still need to wait for the operating system to update the certificate list before they can be protected. Canonical believes that this exposes the current Linux ecosystem's insufficient response speed in the certificate revocation mechanism.
Upki is designed to solve this shortcoming. The project is based on Mozilla's CRLite technology and completes verification through a locally synchronized compact revocation database. There is no need to send additional query requests to the certificate authority when visiting the website. Therefore, it can not only ensure speed and privacy, but also timely identify expired or revoked certificates.
In Ubuntu 26.10, the system can regularly synchronize the latest revocation data through background services, and it is updated every six hours by default. After the first synchronization is completed, upki-enabled applications such as curl can automatically check the certificate status of the target website and refuse to connect to servers using revoked certificates.
Canonical stated that the current deployment of upki in Ubuntu 26.10 is only the first step. In the future, this technology will gradually be extended to the entire operating system and become an important part of Ubuntu's construction of browser-level network security infrastructure. As more and more system components access this mechanism, the Linux platform is expected to see significant improvements in certificate verification, revocation response speed, and overall network security.
Learn more:
https://discourse.ubuntu.com/t/introducing-initial-upki-support/91540
Comments